Tools

Web Request

Make outbound HTTP requests from the agent, with private network protection.

Introduction

The Web Request tool makes HTTP calls to public APIs and websites. It returns the status, headers, and body, and blocks any request that would resolve to a private network.

Making Requests

ParameterRequiredDescription
operationYesOne of get, head, post, put, patch, delete
urlYesThe URL to request
headersNoObject of header name/value pairs
bodyNoRequest body for post, put, patch. JSON is detected automatically.

The response is returned as JSON containing status, a filtered subset of headers (content-type, content-length, location, x-request-id), and the response body.

Allowed Methods

All six standard HTTP methods are supported. Anything else returns an error.

Response Limits

Responses are truncated at 100 KB. The request has a hard timeout of 15 seconds and follows up to 5 redirects. Each redirect URL is re-validated against the private network filter before being followed.

Private Network Protection

The tool will refuse to connect to any host that resolves to a private, loopback, or link-local address. This includes:

  • 127.0.0.0/8 (loopback)
  • 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC 1918)
  • 169.254.0.0/16 (link-local)
  • ::1, fc00::/7, fe80::/10 (IPv6 equivalents)

Every DNS A and AAAA record for the host is checked, so a hostname can't hide a private IP behind a public answer (DNS rebinding defense).

!NOTE The tool description hints at fetching https://markdown.new/{url} to get a webpage as clean Markdown instead of raw HTML, so the agent picks it up automatically when reading pages.

Copyright © 2026